4 ms·

Offensive Security certs are worthwhile, so is GIAC if you can get your employer to pay for them. Other than that, having a CISSP is useful for some employment

Offensive Security certs are worthwhile, so is GIAC if you can get your employer to pay for them. Other than that, having a CISSP is useful for some employment (but effectively meaningless) and having a few networking certs from either Cisco or Juniper is not bad to have. Cyber masters are pretty much totally worthless, although perhaps some idiot employers think they have value. If you can get a masters paid for, the SANS masters seems like the only one worth doing. The NYU Masters is expensive, but somewhat value though it's value comes from basically being a CS degree so just go get a CS masters from Georgia Tech. If you work for the government or military they have their set of required certs (8570 baseline). Certs overall are highly correlated with incompetence in my opinion. Experience is what matters.

austincheney 5y ago
Certs plus experience are even more valuable. That is why the CISSP requires years of experience before you can test.
- tptacek 5y ago
  CISSP is completely useless; even people who believe there are useful certifications don't stick up for it.
  - austincheney 5y ago
    The best part about the CISSP is that it’s a management certification, which deflects so much of the boot camp people that instead become junior developers.
tptacek 5y ago
Most of the time this topic comes up on HN, someone says that certifications are bad, except for the offensive ones (usually, it's OCSP). So, I'm a little uncomfortable making sweeping generalizations about all kinds of certifications, because I don't do Windows IT security†, but I'm pretty sure I've got some grounding in offensive security, since it's where I've spent my career. And what I'll say here is: the best people in this branch of the field almost uniformly don't hold these "good" certifications, and none of the good firms require them. A piece of information that you could provide that would force me to rethink my stance would be a link to a very good, widely respected offensive security firm that states clearly that they give preference to senior candidates with any particular offensive security certification. (If I've heard of the firm, I'll go ask them about it, which might be fun to watch.) † Just kidding, these certifications are all useless.
- easterncalculus 5y ago
  I see your point as someone who's been in the industry for some time, but do you by any chance have recommendations for folks trying to get into it? Every time I've seen threads from people trying to get into offensive security OSCP and other certs come up, even to people that already have college degrees and in some cases experience. Where is that coming from, and what should people do instead? It seems at least to me like there's a real disconnect on this topic between people hiring senior roles and junior employees.
  - tptacek 5y ago
    Take every ounce of energy you would have put into OCSP and plow it into bug bounties, build a portfolio of findings, and get a pentest job. Take a year and figure out where you want to pivot to from there. If you're a blue team type, you're not interested in OCSP, but the answer for you would instead be to build a portfolio of meaty PRs on security open source projects.
    - easterncalculus 5y ago
      Appreciated, thank you.

austincheney 5y ago

Certs plus experience are even more valuable. That is why the CISSP requires years of experience before you can test.

tptacek 5y ago
CISSP is completely useless; even people who believe there are useful certifications don't stick up for it.
- austincheney 5y ago
  The best part about the CISSP is that it’s a management certification, which deflects so much of the boot camp people that instead become junior developers.

tptacek 5y ago

Most of the time this topic comes up on HN, someone says that certifications are bad, except for the offensive ones (usually, it's OCSP). So, I'm a little uncomfortable making sweeping generalizations about all kinds of certifications, because I don't do Windows IT security†, but I'm pretty sure I've got some grounding in offensive security, since it's where I've spent my career. And what I'll say here is: the best people in this branch of the field almost uniformly don't hold these "good" certifications, and none of the good firms require them. A piece of information that you could provide that would force me to rethink my stance would be a link to a very good, widely respected offensive security firm that states clearly that they give preference to senior candidates with any particular offensive security certification. (If I've heard of the firm, I'll go ask them about it, which might be fun to watch.) † Just kidding, these certifications are all useless.

easterncalculus 5y ago
I see your point as someone who's been in the industry for some time, but do you by any chance have recommendations for folks trying to get into it? Every time I've seen threads from people trying to get into offensive security OSCP and other certs come up, even to people that already have college degrees and in some cases experience. Where is that coming from, and what should people do instead? It seems at least to me like there's a real disconnect on this topic between people hiring senior roles and junior employees.
- tptacek 5y ago
  Take every ounce of energy you would have put into OCSP and plow it into bug bounties, build a portfolio of findings, and get a pentest job. Take a year and figure out where you want to pivot to from there. If you're a blue team type, you're not interested in OCSP, but the answer for you would instead be to build a portfolio of meaty PRs on security open source projects.
  - easterncalculus 5y ago
    Appreciated, thank you.